PT-2017-7194 · Puppet · Mcollective-Puppet-Agent

Published 2017-01-30 · Updated 2017-02-24 · CVE-2015-7331

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions mcollective-puppet-agent plugin versions prior to 1.11.1

Description The issue allows remote attackers to execute arbitrary code. This is achieved through vectors involving the --server argument.

Recommendations For versions prior to 1.11.1, update to version 1.11.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the --server argument until a patch is available.

Fix

Weakness Enumeration

CWE-254

Related Identifiers

CVE-2015-7331

Affected Products

Mcollective-Puppet-Agent

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2015-7331 · Security Note
• https://puppet.com/security/cve/cve-2015-7331 · Vendor Advisory
• http://securityfocus.com/bid/92432 · Note